Privacy policy

Qadeem Crafts sells hand-made pieces from Pakistan through this website. This page explains what we collect, why, who we share it with, and what you can ask us to do with it. It was last updated on 9 October 2026.

What we collect

When you place an order: your name, email address, phone number, delivery address, the courier you chose, how you paid, and anything you write in the note. We need all of it to deliver the piece and to keep the shop's accounts.

When you create an account: your name, your email address and a one-way hash of your password, never the password itself. If you sign in with Google, Google gives us your name and email address instead. An account holds your order history and the pieces you have saved.

When you use the contact form: your name, email address, phone number if you give one, and your message. It is emailed to us, not stored on the website.

When you browse, and only if analytics is allowed: the pages and pieces you look at, how you move through them — clicks, taps, scrolling and mouse movement — your approximate location from your IP address, and your type of device and browser. See Analytics, below.

Payments

We never see or store your card number. Card payments from abroad are taken by Stripe, and card and wallet payments in Pakistan by Bank Alfalah, each on its own secure payment page. They tell us whether a payment succeeded and its reference, and nothing else about your card.

Who we share it with

We do not sell personal information, and we do not share it for advertising.

We share only what each party needs to do its part: your delivery details with the courier carrying your parcel, your payment with Stripe or Bank Alfalah, your email address with our email provider so your order confirmation reaches you, and what we store with the companies that host this website and its database. If you allow analytics and chat, Google and Microsoft receive what is described under Analytics, and tawk.to what is described under Live chat, below. We will also disclose information where the law requires it.

Analytics

We use Google Analytics to see which pages and pieces people look at and where the shop loses them, so we can improve it. It sets cookies to recognise a returning visitor, and it reports to us in totals. It does not tell us who you are.

We also use Microsoft Clarity, which records how the pages are used — where you click or tap, how far you scroll, how the mouse moves — so we can replay a visit, or see many visits gathered into a heatmap, and find where a page gets in the way. It never records what you type into a form. The pages and panels that show your name, email address, address or orders are hidden from it completely: a recording shows their layout and none of their words. Clarity sets cookies to recognise a returning visitor and to join the pages of one visit into a single recording.

Microsoft keeps Clarity recordings for 30 days, and the ones we mark as favourites, along with a random sample, for up to nine months. Microsoft's own privacy statement, at microsoft.com/privacy/privacystatement, applies to what it collects.

One choice covers both tools. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics is off until you accept it, and Clarity is not loaded at all until then. Everywhere else it is on unless you turn it off. Either way you can change your mind at any time with Cookie settings at the foot of every page. Turning analytics off stops both tools and deletes the analytics cookies already in your browser.

When an order is placed, or its payment is confirmed, our server tells Google Analytics the order number, the pieces in it and the total. That report is linked to the analytics identifier already in your browser and is sent only if that identifier exists, so if you declined analytics or block it, nothing about your order is sent. Your name, email address, phone number, address and note are never sent to Google or to Microsoft.

Google keeps its data for 14 months. You can also block Google Analytics on every website with Google's browser add-on, at tools.google.com/dlpage/gaoptout.

Live chat

The chat window in the corner of each page is tawk.to. While it is on, tawk.to shows us that someone is browsing, which page they are on, their approximate location from their IP address, and their type of device and browser, so we can answer at the right moment. If you write to us, tawk.to keeps the conversation and anything you tell us in it, such as your name or email address, so either of us can pick it up later.

It follows the same choice as analytics. If you are in the European Economic Area, the United Kingdom or Switzerland, the chat window is not loaded until you accept. Everywhere else it is on unless you turn it off with Cookie settings at the foot of every page, which also closes the chat and deletes its cookies from your browser. WhatsApp and the contact page reach the same people without it.

tawk.to's own privacy policy, at tawk.to/privacy-policy, applies to what it collects.

Cookies and browser storage

_ga and _ga_ followed by an id: Google Analytics. They recognise a returning visitor and group visits into sessions, for up to two years. Set only when analytics is allowed.

_clck and _clsk: Microsoft Clarity. _clck recognises a returning visitor for up to a year; _clsk joins the pages of one visit into a single recording, for a day. Set only when analytics is allowed.

Clarity may also set cookies on Microsoft's own domain, clarity.ms — CLID, MUID, MR, SM and ANONCHK — which identify your browser to Microsoft across the sites that use its services. Microsoft's privacy statement governs them, and turning analytics off asks Clarity to delete its cookies.

Cookies whose names begin with Tawk, twk_ or __tawk: the tawk.to chat window. They keep a conversation going as you move between pages, and let us see an earlier conversation if you come back. Set only when analytics is allowed. tawk.to also sets cookies on its own domain, which its privacy policy governs.

qc-consent: whether you accepted or rejected analytics and chat — Google Analytics, Microsoft Clarity and tawk.to together — so you are not asked on every page. Kept for 180 days.

qc-consent-region: whether the law where you are browsing requires us to ask before using analytics. Kept for one day.

qc-currency: the currency prices are shown in. qc-currency-by: set only when you pick a currency yourself, so it is not changed to match your location. Both kept for 180 days.

authjs cookies: keep you signed in and protect the sign-in form from forgery. Set only when you sign in.

qc-auth-event: set for two minutes after you sign in with Google, so analytics can count that sign-in once. Deleted as soon as it has been read.

Your cart and your light or dark theme are kept in your browser's local storage rather than in cookies. The cart holds only which pieces you added.

The map at the foot of each page is Google Maps, and the video testimonials play from YouTube in its privacy-enhanced mode. The map loads when you scroll to it and a video when you press play, and Google's own privacy policy applies to both.

How long we keep it

Orders are kept for as long as tax and accounting law requires. An account is kept until you ask us to delete it. Messages from the contact form live in our email, and we delete them when the conversation is over.

Your choices and rights

You can ask for a copy of the personal information we hold about you, and ask us to correct or delete it. Some order records have to be kept for the accounts after an account is deleted, and we will tell you if that applies. Write to us through the contact page and we will reply within 30 days.

If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.

Security

Every page on this site is served over an encrypted connection. Passwords are stored as one-way hashes, card details never reach us, and order records are open only to the people who pack and ship them.

Children

The shop is not meant for children under 16, and we do not knowingly collect their information.

Changes to this policy

When this policy changes, the date in its first paragraph changes with it.